This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-90899 | BDVDB-2026-378270 Detail

joomshaper.comEasy Store extension for Joomla

Description#

Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping details (full name, phone number, street address, city, postal code, and country) directly from the #__easystore_guests table with no authentication, session validation, or ownership checks. An unauthenticated attacker could iterate through email lists to enumerate guest customers and harvest sensitive Personally Identifiable Information (PII). Resolved by removing the unauthenticated server-side guest lookup endpoint entirely and migrating autofill functionality to client-side localStorage protected by explicit user consent.

Impact#

Per CVSS v4.0: confidentiality impact high, integrity impact none, availability impact none. Attack vector: network.

Weaknesses#

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-639 Authorization Bypass Through User-Controlled Key

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.